Anti-debugger comprising spatially and temporally separate detection and response portions

ABSTRACT

An anti-debugger comprises spatially and temporally separate detection and response portions. In an example configuration, the anti-debugger is implemented into a game system for detecting and responding to a debugger attached to a game application. The detection portion is implemented on one thread of the system and the response portion is implemented on another thread of the system. When a debugger is detected, a message indicative of the detection is provided to a thread interface. The thread interface provides the message to the response portion. After a period of time has elapsed, the response portion disables the functionality of the game application, such as by halting the game execution and/or obfuscating game performance.

TECHNICAL FIELD

The technical field relates generally to computer processing and morespecifically to online gaming.

BACKGROUND

It is not uncommon for game players to cheat in order to appear to bebetter players than they truly are. Cheating can be especiallyexacerbating in the online gaming community in which players competewith each other. Often, cheating is in the form of modifications to agame application such as, for example, changes to game data constantsand/or characteristics, including the amount of ammunition, the strengthof an item, the health of a player, the position of walls, deleting ofwalls from a map to enable a player to shoot through walls in the game,or the like.

To make modifications to a game, a user typically hacks into her ownversion of the game application. In many cases, the first step towardshacking the game application is to determine exactly what the gamesoftware is doing. One relatively simple way to determine what the gamesoftware is doing is to attach a debugger to the game software while itis executing, and observing the instructions and contents of memory.Through debugging, a hacker can discern appropriate places and means fortampering with the game code. Accordingly, game developers are known toinstall debugger checkers in game code to prevent users from attaching adebugger to the game application. Typically, however, debugger checkersare simple to detect and to circumvent.

SUMMARY

This Summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription Of Illustrative Embodiments. This Summary is not intended toidentify key features or essential features of the claimed subjectmatter, nor is it intended to be used to limit the scope of the claimedsubject matter.

Debugger protection is incorporated into a game system, such that thedebugger detection mechanism and the mechanism for responding todetection of a debugger are difficult to detect, difficult to bypass,and difficult to remove. In an example embodiment, the debuggerdetection mechanism is implemented on one thread and the debuggerdetection response mechanism is implemented on another thread. When adebugger is detected on a first thread, a message indicative of thedetection is provided to a thread interface. The thread interfaceprovides the message to a response mechanism implemented on a secondthread. From the second thread, the response mechanism disables thefunctionality of the game application. The response mechanism candisable game functionality by halting the game execution and/orobfuscating game performance. Further, the response mechanism candisable game functionality immediately or wait a period of time beforedisabling game functionality.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing summary, as well as the following detailed description, isbetter understood when read in conjunction with the appended drawings.For the purpose of illustrating an anti-debugger comprising spatiallyand temporally separate detection and response portions, there is shownin the drawings exemplary constructions thereof; however, ananti-debugger comprising spatially and temporally separate detection andresponse portions is not limited to the specific methods andinstrumentalities disclosed.

FIG. 1 is an illustration depicting an example control flow for ananti-debugger comprising spatially and temporally separate detection andresponse portions.

FIG. 2 is a flow diagram of an example process for implementing ananti-debugger comprising spatially and temporally separate detection andresponse portions.

FIG. 3 is a diagram of an exemplary processor for implementing ananti-debugger comprising spatially and temporally separate detection andresponse portions.

FIG. 4 illustrates functional components of a multimedia/gaming consolethat can be used to implement an anti-debugger comprising spatially andtemporally separate detection and response portions.

FIG. 5 is a depiction of a suitable computing environment in which ananti-debugger comprising spatially and temporally separate detection andresponse portions can be implemented.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

An anti-debugger having a detection portion and a response portion isimplemented in a game system such that the detection portion and a theresponse portion are spatially and temporally separate. The detectionportion of the anti-debugger detects a debugger attached to a gameapplication one thread of a game system and the response portion of theanti-debugger responds to the detection on another thread of the gamesystem. In an example embodiment, a period of time is allowed to elapsebetween detecting the debugger and initiating the response.

FIG. 1 is an illustration depicting an example control flow for a gamesoftware anti-debugger comprising spatially and temporally separatedetection and response portions. An anti-debugger detects a debugger byinvestigating key operating system specific variables, settings, andstate to determine if the system is being debugged. Threads ofexecution, referred to as threads, are implemented via multitasking ortime slicing. In multitasking, multiple tasks (e.g., processes) arescheduled and executed so as to appear to be executing concurrently.Multiple threads execute independently. Multiple threads shareresources, such as a CPU and memory, for example. Execution of multiplethreads is scheduled such that no one thread monopolizes a system or isstarved for resources.

As depicted in FIG. 1, thread boundary 18 indicates that the detectionportion 30 of an anti-debugger executes on a different thread, orthreads, of a system (e.g., XBOX® console) than the thread on which theresponse portion 32 executes. The debugger checker (component 12) isexecuted on a first thread 26. The debugger checker component 12determines if a debugger is attached to a game application (e.g., XBOX®,XBOX® LIVE.). If the debugger checker component 12 detects a debuggerattached to the game application, control passes to message sendingcomponent 14. The message sending component 14 generates a messageindicative of the detection and provides the message to the threadinterface 20. The thread interface provides communication betweenthreads of a system. The thread interface can comprise any appropriatemeans for providing communication between threads. For example, thethread interface can comprise an application programming interface (API)for providing communication between threads. APIs are known in the art.APIs support requests made by computer programs. Typically, an API is asource code interface that can be compiled when an application isgenerated. On the second thread 28, the message is received by thereceive message component 22. In response to receiving the message bythe receive message component 22, control passes to the responsecomponent 24. The response component initiates a response to thedetection of the debugger. In an example embodiment, the gameapplication functionality is disabled in response to the detection.Disabling the functionality can comprise halting game applicationexecution and/or obfuscating operation of the game application. If nodebugger is detected by the debugger checker component 12, controlpasses to normal processing (component 16). During normal processing thedebugger checker 12 is initiated to check for debuggers.

FIG. 2 is a flow diagram of an example process for implementing ananti-debugger comprising spatially and temporally separate detection andresponse portions. In an example embodiment, an anti-debugger fordetecting a debugger attached to a game application, such as a gameexecuting on a game console (e.g., XBOX® game console) utilized in anonline gaming (XBOX® LIVE) scenario, for example, is implemented on atleast two threads. The process depicted in FIG. 1 is described herein inthe context of It is to be understood that this context is exemplary andapplications of in-play detection of altered game data should not belimited thereto. The detection portion of the anti-debugger isimplemented on a first thread at step 34. And, the response portion ofthe anti-debugger is implemented on a second thread at step 36.Anti-Debuggers are known in the art. A debugger is a computer programused to test and debug (fix) another program. An anti-debugger is acomputer program that detects debuggers.

The detection portion of the anti-debugger is activated at step 38. Thedetection portion is activated to detect debuggers attached to the gameapplication. The detection portion can be activated at any appropriatetime. For example, the detection portion can be activated when theexecution of the game application commences, and/or at boot up. Thedetection portion can be activated in any appropriate manner. Thedetection portion can be activated periodically, randomly,quasi-randomly, at the occurrence of specific events, when resources ofthe game system are available, or a combination thereof. The detectionportion can be activated periodically during execution of the gameapplication. The detection portion could be activated periodicallywithin any appropriate time period. For example, the detection portioncould be activated at least once every 25 seconds, at least once everyminute, at least once every 4 minutes, or a combination thereof.

The detection portion can be activated randomly. For example, thedetection portion can be activated at random times within a time periodor time periods. The detection portion can be event driven. For example,the detection portion can be activated when events occur in the game,such as when the game is about to perform a sensitive or interestingtask, such as granting a new item or object. The detection portion canbe activated whenever resources in the system in which the game anddetection portion are running, are available. For example, the detectionportion could be implemented on a low priority thread of the game system(e.g., game device such as an XBOX® console). Thus, when systemresources are available, the thread having the detection portion willactivate the detection portion.

At step 40, it is determined if a debugger is detected. That is, it isdetermined if a debugger is attached to the game application. If nodebugger is detected (at step 40), the process proceeds to step 38 afteran amount of time is elapsed at step 42. The amount of elapsed time canbe any appropriate amount of time as described above with respect toactivation of the detection portion. If a debugger is detected (at step40), a message is generated at step 44. The message is indicative of thedetection. The message is provided, at step 46, to a thread interface.In an example embodiment, an amount of time elapses at step 48. Theamount of time that can elapse at step 48 can be any appropriate amountof time. For example the amount of time can be a predetermined fixedamount of time, the amount of time can be in accordance with apredetermined calculation, the amount of time can be random within afixed period of time, or a combination thereof. In an exampleembodiment, time is allowed to elapse by putting the thread to sleep(e.g. allowing the thread to become temporarily inactive) and utilizingthe operating system to wake the thread after the determined period oftime.

The message is received on the second thread, at step 50, by theresponse portion of the anti-debugger. The response is invoked at step52. In an example embodiment, the response comprises disabling thefunctionality of the game application. For example, the game applicationcan be halted and/or obfuscated. Thus in response to detection of adebugger, the game software is shut down on a randomly or quasi-randomlyselected thread. In another embodiment, in response to detection of adebugger, the game is slowed down, modified, or generally obfuscated,rather than being shut down.

FIG. 3 is a diagram of an exemplary processor 54 for implementing ananti-debugger comprising spatially and temporally separate detection andresponse portions. In an example embodiment, the processor 54 comprisesa game device, such as an XBOX® controller, for example. The processor54 comprises a processing portion 56, a memory portion 58, and aninput/output portion 60. The processing portion 56, memory portion 58,and input/output portion 60 are coupled together (coupling not shown inFIG. 3) to allow communications therebetween. The input/output portion60 is capable of providing and/or receiving components utilized toimplement an anti-debugger comprising spatially and temporally separatedetection and response portions as described above.

The processing portion 56 is capable of implementing an anti-debuggercomprising spatially and temporally separate detection and responseportions as described above. For example, the processing portion 56 iscapable of implementing a detection portion of an anti-debugger on afirst thread and a response portion of the anti-debugger on a secondthread of a game system, activating a detection portion of ananti-debugger, determining an amount of elapsed time, selecting threads,halting the game application, obfuscating the game application,providing a message to a thread interface, receiving a message from athread interface, or a combination thereof.

The processor 54 can be implemented as a client processor and/or aserver processor. In a basic configuration, the processor 54 can includeat least one processing portion 56 and memory portion 58. The memoryportion 58 can store any information utilized in conjunction with ananti-debugger comprising spatially and temporally separate detection andresponse portions. Depending upon the exact configuration and type ofprocessor, the memory portion 58 can be volatile (such as RAM) 62,non-volatile (such as ROM, flash memory, etc.) 64, or a combinationthereof. The processor 54 can have additional features/functionality.For example, the processor 54 can include additional storage (removablestorage 66 and/or non-removable storage 68) including, but not limitedto, magnetic or optical disks, tape, flash, smart cards or a combinationthereof. Computer storage media, such as memory portion 58, 62, 64, 66,and 68, include volatile and nonvolatile, removable and non-removablemedia implemented in any method or technology for storage of informationsuch as computer readable instructions, data structures, programmodules, or other data. Computer storage media include, but are notlimited to, RAM, ROM, EEPROM, flash memory or other memory technology,CD-ROM, digital versatile disks (DVD) or other optical storage, magneticcassettes, magnetic tape, magnetic disk storage or other magneticstorage devices, universal serial bus (USB) compatible memory, smartcards, or any other medium which can be used to store the desiredinformation and which can be accessed by the processor 54. Any suchcomputer storage media can be part of the processor 54.

The processor 54 can also contain communications connection(s) 74 thatallow the processor 54 to communicate with other devices, such as otherdevices in an online gaming scenario, for example. Communicationsconnection(s) 74 is an example of communication media. Communicationmedia typically embody computer readable instructions, data structures,program modules or other data in a modulated data signal such as acarrier wave or other transport mechanism and include any informationdelivery media. The term “modulated data signal” means a signal that hasone or more of its characteristics set or changed in such a manner as toencode information in the signal. By way of example, and not limitation,communication media includes wired media such as a wired network ordirect-wired connection, and wireless media such as acoustic, RF,infrared and other wireless media. The term computer readable media asused herein includes both storage media and communication media. Theprocessor 54 also can have input device(s) 72 such as keyboard, mouse,pen, voice input device, touch input device, etc. Output device(s) 70such as a display, speakers, printer, etc. also can be included.

FIG. 4 illustrates functional components of a multimedia/gaming console300 that can be used to implement an anti-debugger comprising spatiallyand temporally separate detection and response portions. In an exampleembodiment, the multimedia console 300 represents a more detaileddepiction of a game device, such as the processor 54 implemented as agame device. In this example embodiment, the memory portions, processingportions, and the input/output portions of the multimedia console 300are capable of performing the functions of the memory portions,processing portions, and the input/output portions of the processor 54,respectively. The multimedia console 300 has a central processing unit(CPU) 301 having a level 3 cache 302, a level 2 cache 304, and a flashROM (Read Only Memory) 306. The level 3 cache 302 and a level 2 cache304 temporarily store data and hence reduce the number of memory accesscycles, thereby improving processing speed and throughput. The CPU 301can be provided having more than one core, and thus, additional level 3and level 2 caches 302 and 304. The flash ROM 306 can store executablecode that is loaded during an initial phase of a boot process when themultimedia console 300 is powered ON.

A graphics processing unit (GPU) 308 and a video encoder/video codec(coder/decoder) 314 form a video processing pipeline for high speed andhigh resolution graphics processing. Data is carried from the graphicsprocessing unit 308 to the video encoder/video codec 314 via a bus. Thevideo processing pipeline outputs data to an A/V (audio/video) port 340for transmission to a television or other display. A memory controller310 is connected to the GPU 308 to facilitate processor access tovarious types of memory 312, such as, but not limited to, a RAM (RandomAccess Memory).

In an exemplary embodiment, the multimedia console 300 includes aninput/output (I/O) controller 320, a system management controller 322,an audio processing unit 323, a network interface controller 324, afirst USB host controller 326, a second USB controller 328 and a frontpanel I/O subassembly 330 that can be implemented on a module 318. TheUSB controllers 326 and 328 serve as hosts for peripheral controllers342(1)-142(2), a wireless adapter 348, and an external memory device 346(e.g., flash memory, external CD/DVD ROM drive, removable media, etc.).The network interface 324 and/or wireless adapter 348 provide access toa network (e.g., the Internet, home network, etc.) and can be any of awide variety of various wired or wireless adapter components includingan Ethernet card, a modem, a Bluetooth module, a cable modem, and thelike.

System memory 343 is provided to store application data that is loadedduring the boot process. A media drive 344 is provided and can comprisea DVD/CD drive, hard drive, or other removable media drive, etc. Themedia drive 344 can be internal or external to the multimedia console300. Application data can be accessed via the media drive 344 forexecution, playback, etc. by the multimedia console 300. The media drive344 is connected to the I/O controller 320 via a bus, such as a SerialATA bus or other high speed connection (e.g., IEEE 3394).

The system management controller 322 provides a variety of servicefunctions related to assuring availability of the multimedia console300. The audio processing unit 323 and an audio codec 332 form acorresponding audio processing pipeline with high fidelity and stereoprocessing. Audio data is carried between the audio processing unit 323and the audio codec 332 via a communication link. The audio processingpipeline outputs data to the A/V port 340 for reproduction by anexternal audio player or device having audio capabilities.

The front panel I/O subassembly 330 supports the functionality of thepower button 353 and the eject button 352, as well as any LEDs (lightemitting diodes) or other indicators exposed on the outer surface of themultimedia console 300. A system power supply module 336 provides powerto the components of the multimedia console 300. A fan 338 cools thecircuitry within the multimedia console 300.

The CPU 301, GPU 308, memory controller 310, and various othercomponents within the multimedia console 300 are interconnected via oneor more buses, including serial and parallel buses, a memory bus, aperipheral bus, and a processor or local bus using any of a variety ofbus architectures. By way of example, such architectures can include aPeripheral Component Interconnects (PCI) bus, PCI-Express bus, etc.

When the multimedia console 300 is powered ON, application data can beloaded from the system memory 343 into memory 312 and/or caches 302, 304and executed on the CPU 301. The application can present a graphicaluser interface that provides a consistent user experience whennavigating to different media types available on the multimedia console300. In operation, applications and/or other media contained within themedia drive 344 can be launched or played from the media drive 344 toprovide additional functionalities to the multimedia console 300.

The multimedia console 300 can be operated as a standalone system bysimply connecting the system to a television or other display. In thisstandalone mode, the multimedia console 300 allows one or more users tointeract with the system, watch movies, or listen to music. However,with the integration of broadband connectivity made available throughthe network interface 324 or the wireless adapter 348, the multimediaconsole 300 can further be operated as a participant in the largernetwork community, such as an online gaming community for example.

FIG. 5 and the following discussion provide a brief general descriptionof a suitable computing environment in which an anti-debugger comprisingspatially and temporally separate detection and response portions can beimplemented. Although not required, various aspects of an anti-debuggercomprising spatially and temporally separate detection and responseportions can be described in the general context of computer executableinstructions, such as program modules, being executed by a computer,such as a client workstation or a server. Generally, program modulesinclude routines, programs, objects, components, data structures and thelike that perform particular tasks or implement particular abstract datatypes. Moreover, implementation of multi-threaded detection of a gamesoftware debugger can be practiced with other computer systemconfigurations, including hand held devices, multi processor systems,microprocessor based or programmable consumer electronics, network PCs,minicomputers, mainframe computers, and the like. Further,multi-threaded detection of a game software debugger also can bepracticed in distributed computing environments where tasks areperformed by remote processing devices that are linked through acommunications network. In a distributed computing environment, programmodules can be located in both local and remote memory storage devices.

A computer system can be roughly divided into three component groups:the hardware component, the hardware/software interface systemcomponent, and the applications programs component (also referred to asthe “user component” or “software component”). In various embodiments ofa computer system the hardware component may comprise the centralprocessing unit (CPU) 521, the memory (both ROM 564 and RAM 525), thebasic input/output system (BIOS) 566, and various input/output (I/O)devices such as a keyboard 540, a mouse 542, a monitor 547, and/or aprinter (not shown), among other things. The hardware componentcomprises the basic physical infrastructure for the computer system.

The applications programs component comprises various software programsincluding but not limited to compilers, database systems, wordprocessors, business programs, videogames, and so forth. Applicationprograms provide the means by which computer resources are utilized tosolve problems, provide solutions, and process data for various users(machines, other computer systems, and/or end-users). In an exampleembodiment, application programs perform the functions associated withan anti-debugger comprising spatially and temporally separate detectionand response portions as described above.

The hardware/software interface system component comprises (and, in someembodiments, may solely consist of) an operating system that itselfcomprises, in most cases, a shell and a kernel. An “operating system”(OS) is a special program that acts as an intermediary betweenapplication programs and computer hardware. The hardware/softwareinterface system component may also comprise a virtual machine manager(VMM), a Common Language Runtime (CLR) or its functional equivalent, aJava Virtual Machine (JVM) or its functional equivalent, or other suchsoftware components in the place of or in addition to the operatingsystem in a computer system. A purpose of a hardware/software interfacesystem is to provide an environment in which a user can executeapplication programs.

The hardware/software interface system is generally loaded into acomputer system at startup and thereafter manages all of the applicationprograms in the computer system. The application programs interact withthe hardware/software interface system by requesting services via anapplication program interface (API). Some application programs enableend-users to interact with the hardware/software interface system via auser interface such as a command language or a graphical user interface(GUI).

A hardware/software interface system traditionally performs a variety ofservices for applications. In a multitasking hardware/software interfacesystem where multiple programs may be running at the same time, thehardware/software interface system determines which applications shouldrun in what order and how much time should be allowed for eachapplication before switching to another application for a turn. Thehardware/software interface system also manages the sharing of internalmemory among multiple applications, and handles input and output to andfrom attached hardware devices such as hard disks, printers, and dial-upports. The hardware/software interface system also sends messages toeach application (and, in certain case, to the end-user) regarding thestatus of operations and any errors that may have occurred. Thehardware/software interface system can also offload the management ofbatch jobs (e.g., printing) so that the initiating application is freedfrom this work and can resume other processing and/or operations. Oncomputers that can provide parallel processing, a hardware/softwareinterface system also manages dividing a program so that it runs on morethan one processor at a time.

A hardware/software interface system shell (referred to as a “shell”) isan interactive end-user interface to a hardware/software interfacesystem. (A shell may also be referred to as a “command interpreter” or,in an operating system, as an “operating system shell”). A shell is theouter layer of a hardware/software interface system that is directlyaccessible by application programs and/or end-users. In contrast to ashell, a kernel is a hardware/software interface system's innermostlayer that interacts directly with the hardware components.

As shown in FIG. 5, an exemplary general purpose computing systemincludes a conventional computing device 560 or the like, including aprocessing unit 521, a system memory 562, and a system bus 523 thatcouples various system components including the system memory to theprocessing unit 521. The system bus 523 may be any of several types ofbus structures including a memory bus or memory controller, a peripheralbus, and a local bus using any of a variety of bus architectures. Thesystem memory includes read only memory (ROM) 564 and random accessmemory (RAM) 525. A basic input/output system 566 (BIOS), containingbasic routines that help to transfer information between elements withinthe computing device 560, such as during start up, is stored in ROM 564.The computing device 560 may further include a hard disk drive 527 forreading from and writing to a hard disk (hard disk not shown), amagnetic disk drive 528 (e.g., floppy drive) for reading from or writingto a removable magnetic disk 529 (e.g., floppy disk, removal storage),and an optical disk drive 530 for reading from or writing to a removableoptical disk 531 such as a CD ROM or other optical media. The hard diskdrive 527, magnetic disk drive 528, and optical disk drive 530 areconnected to the system bus 523 by a hard disk drive interface 532, amagnetic disk drive interface 533, and an optical drive interface 534,respectively. The drives and their associated computer readable mediaprovide non volatile storage of computer readable instructions, datastructures, program modules and other data for the computing device 560.Although the exemplary environment described herein employs a hard disk,a removable magnetic disk 529, and a removable optical disk 531, itshould be appreciated by those skilled in the art that other types ofcomputer readable media which can store data that is accessible by acomputer, such as magnetic cassettes, flash memory cards, digital videodisks, Bernoulli cartridges, random access memories (RAMs), read onlymemories (ROMs), and the like may also be used in the exemplaryoperating environment. Likewise, the exemplary environment may alsoinclude many types of monitoring devices such as heat sensors andsecurity or fire alarm systems, and other sources of information.

A number of program modules can be stored on the hard disk, magneticdisk 529, optical disk 531, ROM 564, or RAM 525, including an operatingsystem 535, one or more application programs 536, other program modules537, and program data 538. A user may enter commands and informationinto the computing device 560 through input devices such as a keyboard540 and pointing device 542 (e.g., mouse). Other input devices (notshown) may include a microphone, joystick, game pad, satellite disk,scanner, or the like. These and other input devices are often connectedto the processing unit 521 through a serial port interface 546 that iscoupled to the system bus, but may be connected by other interfaces,such as a parallel port, game port, or universal serial bus (USB). Amonitor 547 or other type of display device is also connected to thesystem bus 523 via an interface, such as a video adapter 548. Inaddition to the monitor 547, computing devices typically include otherperipheral output devices (not shown), such as speakers and printers.The exemplary environment of FIG. 5 also includes a host adapter 555,Small Computer System Interface (SCSI) bus 556, and an external storagedevice 562 connected to the SCSI bus 556.

The computing device 560 may operate in a networked environment usinglogical connections to one or more remote computers, such as a remotecomputer 549. The remote computer 549 may be another computing device(e.g., personal computer), a server, a router, a network PC, a peerdevice, or other common network node, and typically includes many or allof the elements described above relative to the computing device 560,although only a memory storage device 550 (floppy drive) has beenillustrated in FIG. 5. The logical connections depicted in FIG. 5include a local area network (LAN) 551 and a wide area network (WAN)552. Such networking environments are commonplace in offices, enterprisewide computer networks, intranets and the Internet.

When used in a LAN networking environment, the computing device 560 isconnected to the LAN 551 through a network interface or adapter 553.When used in a WAN networking environment, the computing device 560 caninclude a modem 554 or other means for establishing communications overthe wide area network 552, such as the Internet. The modem 554, whichmay be internal or external, is connected to the system bus 523 via theserial port interface 546. In a networked environment, program modulesdepicted relative to the computing device 560, or portions thereof, maybe stored in the remote memory storage device. It will be appreciatedthat the network connections shown are exemplary and other means ofestablishing a communications link between the computers may be used.

While it is envisioned that numerous embodiments of an anti-debuggercomprising spatially and temporally separate detection and responseportions are particularly well-suited for computerized systems, nothingin this document is intended to limit the invention to such embodiments.On the contrary, as used herein the term “computer system” is intendedto encompass any and all devices capable of storing and processinginformation and/or capable of using the stored information to controlthe behavior or execution of the device itself, regardless of whethersuch devices are electronic, mechanical, logical, or virtual in nature.

The various techniques described herein can be implemented in connectionwith hardware or software or, where appropriate, with a combination ofboth. Thus, the methods and apparatuses for implementing ananti-debugger comprising spatially and temporally separate detection andresponse portions, or certain aspects or portions thereof, can take theform of program code (i.e., instructions) embodied in tangible media,such as floppy diskettes, CD-ROMs, hard drives, or any othermachine-readable storage medium, wherein, when the program code isloaded into and executed by a machine, such as a computer, the machinebecomes an apparatus for implementing an anti-debugger comprisingspatially and temporally separate detection and response portions.

The program(s) can be implemented in assembly or machine language, ifdesired. In any case, the language can be a compiled or interpretedlanguage, and combined with hardware implementations. The methods andapparatuses for implementing an anti-debugger comprising spatially andtemporally separate detection and response portions also can bepracticed via communications embodied in the form of program code thatis transmitted over some transmission medium, such as over electricalwiring or cabling, through fiber optics, or via any other form oftransmission, wherein, when the program code is received and loaded intoand executed by a machine, such as an EPROM, a gate array, aprogrammable logic device (PLD), a client computer, or the like. Whenimplemented on a general-purpose processor, the program code combineswith the processor to provide a unique apparatus that operates to invokethe functionality of an anti-debugger comprising spatially andtemporally separate detection and response portions. Additionally, anystorage techniques used in connection with an anti-debugger comprisingspatially and temporally separate detection and response portions caninvariably be a combination of hardware and software.

While an anti-debugger comprising spatially and temporally separatedetection and response portions has been described in connection withthe example embodiments of the various figures, it is to be understoodthat other similar embodiments can be used or modifications andadditions can be made to the described embodiments for performing thesame functions of an anti-debugger comprising spatially and temporallyseparate detection and response portions without deviating therefrom.Therefore, an anti-debugger comprising spatially and temporally separatedetection and response portions as described herein should not belimited to any single embodiment, but rather should be construed inbreadth and scope in accordance with the appended claims.

1. An anti-debugging method comprising: implementing on a first thread,a detection portion of an anti-debugger; implementing on a secondthread, a response portion of the anti-debugger; activating thedetection portion of the anti-debugger for detecting a debugger that isattached to an application for hacking the application; generating amessage indicative of the detection; providing the message to a threadinterface; receiving the message via the thread interface, on the secondthread; and invoking thereto, a response from the response portion ofthe anti-debugger, the response comprising operating upon afunctionality of the application.
 2. A method in accordance with claim1, wherein the application comprises a game application, and whereinhacking the application comprises undesirably tampering with game codeof the game application.
 3. A method in accordance with claim 1, furthercomprising allowing an amount of time to elapse between detecting adebugger attached to the application and operating upon thefunctionality of the application.
 4. A method in accordance with claim3, wherein the amount of time is randomly determined.
 5. A method inaccordance with claim 3, wherein the amount of time comprises apredetermined amount of time.
 6. A method in accordance with claim 3,wherein the amount of time is determined in accordance with an eventoccurring in the system.
 7. A method in accordance with claim 1, whereinoperating upon the functionality comprises disabling the functionality.8. An anti-debugging processor comprising: detection circuitry of ananti-debugger, the detection circuitry implemented on a first thread ofa system, the detection circuitry configured to: detect, on the firstthread, a debugger attached to a game application for hacking the gameapplication; generate a message indicative of the detection; and providethe message to a thread interface, the thread interface configured toprovide communication between at least two threads of the system; andresponse circuitry of the anti-debugger, the response circuitryimplemented on a second thread of the system, the response circuitryconfigured to: receive, on the second thread, the message via the threadinterface; and invoke a response comprising operating on a functionalityof the game application.
 9. The processor of claim 8, wherein the gameapplication comprises an online game application.
 10. The processor ofclaim 8, wherein operating upon the functionality comprises disabling afunctionality of the game application, and further comprising allowingan amount of time to elapse between detecting the debugger attached tothe game application and disabling the functionality of the gameapplication.
 11. The processor of claim 10, wherein the amount of timeis randomly determined.
 12. The processor of claim 10, wherein theamount of time comprises a predetermined amount of time.
 13. Theprocessor of claim 10, wherein the amount of time is determined inaccordance with an event occurring in the system.
 14. The processor ofclaim 8, wherein operating upon the functionality comprises at least oneof halting execution of the game application or obfuscating aperformance of the game application.
 15. A computer-readable storagemedium that is not a transient signal, the computer-readable storagemedium having stored thereon computer-executable instructions forperforming the steps of: implementing on a first thread, a detectionportion of an anti-debugger; implementing on a second thread, a responseportion of the anti-debugger; activating the detection portion of theanti-debugger for detecting a debugger that is attached to a gameapplication for hacking the game application; generating a messageindicative of the detection; providing the message to a threadinterface; receiving the message via the thread interface, on the secondthread; and invoking thereto, a response from the response portion ofthe anti-debugger, the response comprising operating upon afunctionality of the game application.
 16. A computer-readable storagemedium in accordance with claim 15, wherein the game applicationcomprises an online game application.
 17. A computer-readable storagemedium in accordance with claim 15, further comprising allowing anamount of time to elapse between detecting a debugger attached to thegame application and operating upon the functionality of the gameapplication.
 18. A computer-readable storage medium in accordance withclaim 17, wherein the amount of time is randomly determined.
 19. Acomputer-readable storage medium in accordance with claim 17, whereinthe amount of time comprises a predetermined amount of time.
 20. Acomputer-readable storage medium in accordance with claim 17, whereinthe amount of time is determined in accordance with an event occurringin the system.